Application No. 10/706,334 Amdt. dated January 16, 2008 

Reply to Office Action of November 16, 2007 

REMARKS 

In the Office Action, the Examiner indicated that Claims 1 through 18 are pending in the 
application and the Examiner rejected all claims. 

Claim Rejections, 35 U.S.C. § 102 

On page 4 of the Office Action, the Examiner rejected Claims 1-18 under 35 U.S.C. 
§ 102(e) as being anticipated by U.S. Patent Application No. 20060075122 to Lindskog et al. 
("Lindskog"). This rejection is respectfully traversed. 

The Present Invention 

The present claimed invention teaches a method, computer program product and system 
for using a digital signature in privacy policies submitted to an E-Marketplace where electronic 
transactions are conducted. 

Claim 1, as amended, recites : 

A method of conducting electronic commerce transactions among a plurality of 

participants in an E-marketplace, comprising the steps of: 
the E-marketplace obtaining digitally-signed privacy-use information for each participant; 

and 

the E-marketplace sharing the digitally-signed privacy-use information with any 

participants interested in doing business with each other in the E-marketplace. 

Amended claims 7 and 13 recite similar language. 

In the claimed invention, the E-marketplace obtains digitally signed privacy-use information 

(privacy policy) from each of a plurality of participants and then shares the digitally signed privacy 
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information with any participants interested in doing business with each other. The E-marketplace is 
discussed on page 7, lines 2-15 of the specification and shown in Figs. 1 and 2 as being a distinct entity 
that is coupled to a plurality of participants including buyers, sellers and third parties through a network 
such as the internet. The E-marketplace receives communications from the buyers, sellers and third 
parties; stores information for viewing by the participants; and stores information relating to transactions 
that occur in the E-marketplace. Thus, the E-marketplace is a separate entity from the plurality of 
participants in the E-marketplace. 

U.S. Patent Application No. 20060075122 to Lindskog et al. 

U.S. Patent Application No. 20060075122 to Lindskog et al. ("Lindskog") teaches that a 

single user (through the use of a user agent that is associated with the user or provided in the user 

equipment) (page 2, paragraph [0017] of Lindskog) generates a receipt when the user accepts a 

privacy policy file that has been transmitted by a content provider to the user agent (Abstract of 

Lindskog). First, the user agent requests a resource over the internet from a content provider on 

behalf of a user. In response, the content provider transmits a privacy policy file containing 

information regarding the usage of cookies to the user agent. The user agent then transmits a cookie 

receipt back to the content provider specifying whether the user accepts the policy. As a result, the 

content provider is made aware of whether the user will permit the content provider to transmit a 

cookie along with the requested resource. The invention of Lindskog only discloses the existence of 

one privacy policy file (that of the content provider) and the privacy policy file is only transmitted 

one time (from the content provider to the user agent). The invention of Lindskog does not teach 
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that a privacy policy file is ever transmitted to any type of intermediary at any time and does not 
teach that any other privacy policy files other than that of the content provider are transmitted at any 
time. 

The Cited Prior Art Does Not Anticipate the Claimed Invention 

The MPEP and case law provide the following definition of anticipation for the purposes of 
35 U.S.C. § 102: 

A claim is anticipated only if each and every element as set forth in the claim is 
found, either expressly or inherently described, in a single prior art reference." MPEP 
§ 2131 citing Verdegaal Bros. v. Union Oil Company of California, 814 F.2d 628, 
631, 2 U.S.P.Q. 2d 1051, 1053 (Fed. Cir. 1987) 

The Examiner Has Not Established a Prima Facie Case of Anticipation 

As noted above, the claims of the present invention recite that digitally-signed privacy-use 
information is obtained by an E-marketplace for each of a plurality of participants. Then, the E- 
marketplace shares the privacy information with the participants in the E-marketplace. 

The nature of problem solved by the present claimed invention is that the privacy-use 
information is under the control of an intermediary (the E-marketplace) after it is submitted by one 
participant and before it is shared with another participant, so that a third party has an opportunity to 
modify privacy policy. The integrity of the digital signature ensures that privacy policies are not 
tampered with while under the control of the E-marketplace. By including a digital signature in a 
privacy policy submitted to the E-marketplace by a participant, other participants that subsequently 
receive the privacy policy from the E-marketplace can ensure the integrity of the privacy policy by 
Page 4 of 9 



Application No. 10/706,334 Amdt. dated January 16, 2008 

Reply to Office Action of November 16, 2007 

ensuring that the digital signature has not been altered by the E-marketplace or any other intermediary. 
Such assurance prevents an unscrupulous E-marketplace administration from modifying a submitted 
privacy policy before sharing it with the other participants and prevents an unscrupulous vendor from 
later denying the terms of the policy as being valid. 

In contrast to the present invention, nowhere does Lindskog teach that a privacy policy is 
obtained by an intermediary from one entity and then shared by the intermediary with a second 
entity. Rather, the privacy policy of Lindskog is transmitted only once, from a single content 
provider to a single user agent. Thus, the problem of ensuring the integrity of the policy while it is 
under the control of an intermediary does not even exist in Lindskog. 

Response to the Examiner's Arguments 

On page 2 of the Office Action, in the section entitled Response 1, the Examiner states 
that "the PTO has not been able to find the aspect of the policy being transmitted to an 
intermediary at any time in the claims." However, each independent claim in the present 
application clearly states that the E-marketplace obtains digitally-signed privacy-use information 
for each participant and the E-marketplace shares the digitally-signed privacy-use information 
with any participants interested in doing business with each other in the E-marketplace. Thus, 
the E-marketplace acts as an intermediary between participants to transactions by obtaining 
digitally-signed privacy-use information from each entity/participant (each one of the claimed 
plurality of participants) and then sharing the digitally-signed privacy-use information with each 
other entity/participant (each one of the "any participants interested in doing business with each 
other in the E-marketplace"). 
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Additionally, the Examiner proceeds to discuss an example where a computer server 
hosts a website for a company and offers services and resources. However, nowhere in the 
Examiner's example is there any mention of any entity that performs the steps of the E- 
marketplace in the present invention, i.e., obtaining digitally-signed privacy-use information for 
each participant and then sharing the digitally-signed privacy-use information with every other 
participant interested in doing business with each other in the E-marketplace. Also, the 
Examiner's example does not appear to bear any relation to the invention of Lindskog. Thus, 
Applicants are unclear as to the relevance of the Examiner's example. 

On page 2-3 of the Office Action, in the section entitled Response 2, the Examiner first 
cites the Merriam Webster definition of the word "entity" and then incorrectly states that the 
entities per Applicant's invention are (1) web hosting (which is not mentioned anywhere in the 
claims of the present application), (2) the company selling the goods/services and (3) users. In 
actuality, the entities of Applicant's invention are the E-marketplace and any two of the 
participants in the E-marketplace who are interested in doing business with each other. The E- 
marketplace obtains a privacy policy from each participant and transmits a privacy policy to each 
participant. 

Next, in relating his arguments to Lindskog, first the Examiner correctly points out the 
single instance of the giving of a privacy policy in the invention of Lindskog (user's opportunity 
to accept or reject content provider's policy as described in paragraphs [0022] to [0024]). 
Subsequently the Examiner incorrectly states that paragraph [0017] of Lindskog discloses that a 
third party obtains a privacy policy from a seller and third party shares the policy with the user. 
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What paragraph [0017] of Lindskog actually discloses is that "a user agent associated with or 

provided in the user equipment receives a privacy policy for the content provider." Thus, only 

one privacy policy is obtained from one entity in paragraph [0017] of Lindskog (the user agent 

obtaining from the content provider). Under the Examiner's cited definition of "entity", the user 

agent in Lindskog is not a different entity than the user because it is not a "separate, independent 

existence from the user." Rather, the user agent is provided in the user equipment. Additionally, 

nowhere does the user agent in Lindskog share the content provider's privacy policy with any 

entity. And, unlike the present claimed invention which obtains digitally-signed privacy-use 

information for each participant, nowhere does the user agent in Lindskog obtain any other 

privacy policy from of any other entity than the content provider and then share that other 

obtained privacy policy with the content provider. For these reasons, Lindskog does not disclose 

or suggest the present claimed invention. 

The Examiner maintains that obtaining digitally-signed privacy-use information for each 

participant as recited by claim 1 is disclosed by the following language in Lindskog: 

User clicks on seller website for content, and a third party obtains a privacy policy 
from the seller (paragraphs [0017] and [0046] of Lindskog) - The invention deals 
with usage in a P3P agreement procedure for providing resources from content 
providers over the internet (marketplace) (paragraph [0025])" 

The Examiner further maintains that paragraphs [0017], [0018] and [0046] of Lindskog teach 

"sharing the digitally-signed privacy-use information with any participants interested in doing 

business with each other in the E-marketplace." 

It is still unclear what element of Lindskog is being asserted by the Examiner to be the 
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same as the E-marketplace of the present invention. The Examiner continues to alternatively 
state that the internet in Lindskog and the user in Lindskog are the same as the E-marketplace in 
the present claimed invention. However, neither the internet nor the user agent of Lindskog are 
the same as the E-marketplace of the present invention. Rather, the E-marketplace in the present 
invention is an entity that obtains a privacy policy from one participant and the shares the policy 
with another participant and internet is simply used to transfer the information in Lindskog from 
the content provider to the user agent and is similarly shown in Figs. 1 and 2 of the present 
application as being used to transfer information between the E-marketplace and the various 
participants in the E-marketplace. Nowhere does Lindskog disclose that the internet is a distinct 
entity which obtains privacy-use information from one entity and then shares it with another 
entity. 

Additionally, the user of Lindskog is not the same as the participant in the presently 
claimed invention with whom the privacy-use information is shared, as maintained by the 
Examiner. The user and the user agent in Lindskog are both part of the same node in the 
transmission of the privacy file. The privacy policy file is transmitted to the user agent, and the 
user agent specifies whether the user accepts the policy or not without any further transmission of 
the privacy policy file. The content provider is the only entity that transmits a privacy policy. 
Nowhere does Lindskog disclose that the user agent must explicitly share the privacy policy file 
with the user as one entity would have to share it with another entity or that privacy information 
is obtained from each participant as recited in the claims of the present invention. 

Each of the independent claims expressly recite the above elements that are neither taught 
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nor suggested by Lindskog. Accordingly, each of the independent claims (Claims 1, 7 and 13), 
and all claims depending therefrom, patentably define over Lindskog and are in condition for 
allowance. 

Conclusion 

The present invention is not taught or suggested by the prior art. Accordingly, the Examiner 
is respectfully requested to reconsider and withdraw the rejection of the claims. An early Notice of 
Allowance is earnestly solicited. 



The Commissioner is hereby authorized to charge any additional fees or credit any 
overpayment associated with this communication to Deposit Account No. 09-0461. 

Respectfully submitted, 



January 16, 2008 
Date 



/Mark D. Simpson/ 
Mark D. Simpson, Esquire 
Registration No. 32,942 



SYNNESTVEDT & LECHNER LLP 
1101 Market Street 
Suite 2600 

Philadelphia, PA 19107 
Telephone: (215) 923-4466 
Facsimile: (215) 923-2189 



Page 9 of 9 



